commit a87019820aa06686f63041d608ac3c6dc67f9fed
author Tianjie Xu <xunchang@google.com> Fri Oct 07 00:15:00 2016 +0000
committer android-build-merger <android-build-merger@google.com> Fri Oct 07 00:15:00 2016 +0000
tree 7eb50f1740b05726d114eb0d18ccf5f47b075a1e
parent 5ff756bb852162652c979664aa94c750fdc4cc6a
parent 21d8b24ec379cf80013d45e16a48f4c3b2c0f7d2

Fix out of bound access in libziparchive am: 1ee4892e66 am: c24dd97654 am: 8788591224
am: 167562aa76

Change-Id: Icb066cdaf63d87324c6eca8b5b45dbc23235aaa2

libziparchive/zip_archive.cc

diff --git a/libziparchive/zip_archive.cc b/libziparchive/zip_archive.cc
index cc39aa5..a17091f 100644
--- a/libziparchive/zip_archive.cc
+++ b/libziparchive/zip_archive.cc
@@ -463,9 +463,14 @@
    * Grab the CD offset and size, and the number of entries in the
    * archive and verify that they look reasonable.
    */
-  if (eocd->cd_start_offset + eocd->cd_size > eocd_offset) {
+  if (static_cast<off64_t>(eocd->cd_start_offset) + eocd->cd_size > eocd_offset) {
     ALOGW("Zip: bad offsets (dir %" PRIu32 ", size %" PRIu32 ", eocd %" PRId64 ")",
         eocd->cd_start_offset, eocd->cd_size, static_cast<int64_t>(eocd_offset));
+#if defined(__ANDROID__)
+    if (eocd->cd_start_offset + eocd->cd_size <= eocd_offset) {
+      android_errorWriteLog(0x534e4554, "31251826");
+    }
+#endif
     return kInvalidOffset;
   }
   if (eocd->num_records == 0) {